Skip to content

secretservice: allow headless credential access - #2474

Merged
mjcheetham merged 1 commit into
git-ecosystem:mainfrom
mjcheetham:headless-linux
Oct 16, 2026
Merged

mjcheetham merged 1 commit into
git-ecosystem:mainfrom
mjcheetham:headless-linux

Conversation

@mjcheetham

@mjcheetham mjcheetham commented Oct 14, 2026 •

Copy link
Copy Markdown
Contributor

An unlocked Secret Service collection does not require a desktop session. The DISPLAY/WAYLAND_DISPLAY check rejects legitimate SSH and terminal sessions even when their keyring is already available.

Use actual bus connectivity and Secret Service initialization as the availability checks rather than treating the presence of a display as proof. Native error details and actionable guidance help users distinguish an absent service from a locked collection or a cancelled prompt.

Provider-owned prompting remains unchanged. Headless users still need to provision their session bus and unlock collections through their provider; this change does not introduce terminal prompting or start D-Bus explicitly.

Rendered docs:

@mjcheetham
mjcheetham requested a review from a team as a code owner October 14, 2026 14:38
@mjcheetham

Copy link
Copy Markdown
Contributor Author

Note that the failing checks are about new links to external sites in the markdown files. I've checked them manually and they work fine. The errors we're seeing include:

  * [403] <https://invent.kde.org/frameworks/kwallet> (at 12:1) | Rejected status code: 403 Forbidden
  * [418] <https://www.freedesktop.org/wiki/Software/dbus/> (at 14:1) | Rejected status code: 418 I'm a teapot

I believe they are both reacting to the 'bot-like' nature of the linter.

An unlocked Secret Service collection does not require a desktop session.
The DISPLAY/WAYLAND_DISPLAY check rejects legitimate SSH and terminal
sessions even when their keyring is already available.

Use actual bus connectivity and Secret Service initialization as the
availability checks rather than treating the presence of a display as
proof. Native error details and actionable guidance help users
distinguish an absent service from a locked collection or a cancelled
prompt.

Provider-owned prompting remains unchanged. Headless users still need
to provision their session bus and unlock collections through their
provider; this change does not introduce terminal prompting or start
D-Bus explicitly.

Assisted-by: GPT-6.1 Sol
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

@dscho dscho left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trusting that libgio-2.0.so.0 will remain stable, this Looks Good To Me!

@dscho

dscho commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

From https://github.com/git-ecosystem/git-credential-manager/actions/runs/38584569655/job/116354921925?pr=2474:

This works for me, I guess this is a transient error (probably they try to defend against AI onslaught).

@mjcheetham
mjcheetham merged commit e66693f into git-ecosystem:main Oct 16, 2026
27 of 30 checks passed
@mjcheetham
mjcheetham deleted the headless-linux branch October 16, 2026 14:19
@mjcheetham mjcheetham mentioned this pull request Oct 26, 2026
mjcheetham added a commit that referenced this pull request Oct 26, 2026
**Changes:**

- Dependency updates (#2483)
- Documentation updates for AI agents (#2469)
- Official release pipeline signing fixes, and update to use the new Mac
pool (#2467, #2468)
- Fix for Linux SecretService credential MIME type (#2475)
- Allow headless use of Linux SecretService (#2474)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants